Comment on Help configuring OPNsense VLANs? Tutorials I find seem to quickly become outdated.
MuttMutt@lemmy.world 1 day agoIt’s not just about the advanced functions. Many of the older more basic tools are single threaded which will potentially limit the performance. As you figure things out you will want to do more and you may find the current tools more of a limiting factor. But the choice is yours, I have 2 48port gigabit switches and WiFi SSID’s that connect to specific vLAN’s through tagging. I started with some dumb switches and added my 10Gbps backbone switch which I used as a dumb switch for years so I could connect my desktop and server over a faster connection.
In my equipment an untagged port is what a port is where the vLAN is stripped away. A tagged port has the vLAN tag passed to the device. If you can set multiple vlan tags on the same port that port becomes a trunked port. You may also be able to set a vlan as untagged on that port, if a device is plugged into that port it will by default be on the untagged vLAN. If the device is able to handle vLAN tagging it can live on the vLAN’s you set up as well.
It took me a bit to figure it all out and get it working. I spent about 20 hours configuring things before I started making the switch from a single net to multiple vLAN’s. I spent another 8 hours making the change and 5 or 6 more tweaking things.
I watched and rewatched tutorial videos, traced my cables and ports, and configured the port settings until I was able to ping the gateway on this VLAN. That’s as far as I’ve gotten. Over the course of today, since posting this thread, I’ve rechecked those settings a handful of times, and they still appear to be correct as far as I know. If I delete the extremely permissive firewall rule that I set up for the VLAN, I lose the ability to ping the gateway, which seemingly validates the rest of my setup and leads me to believe that this is a configuration issue in OPNsense rather than the configuration of my switches…but I don’t know what I don’t know, and I’m still learning this stuff.
I understand that you’re recommending what you think is best based on your experience, but as I’ve been trying to learn self hosting with a semi-simple goal in mind, the extra complexity that folks keep recommending around just about every facet, because their needs or desires are greater than mine once they’re more seasoned than me, does make it all more difficult to take in during the learning process. Maybe I’ll want to go more advanced some day, but for now, the goal is to host fewer than a dozen services off of two different devices that live under my office desk and consume under 100W between them. I want VLANs for this as a means of separation in case the security of my exposed services is compromised, but with this smoke test, I want to prove that I understand the basics of doing so, so it’s currently feeling defeating that I don’t. I don’t want to sound like I’m not appreciative of any help you can offer, but I do still believe that simpler is better for me at this point.
My firewall mini PC has four ports, but only two of them are active; LAN and WAN. I got that much working without much fuss and replaced my ISP’s provided router. There were two dumb switches between the firewall and the office, but once that was working, I replaced them with managed switches; when they’re not yet configured, they’re indistinguishable from dumb switches. I’ve been over my OPNsense configuration a dozen times in this thread by now, but let’s just say this new VLAN is set to be as permissible as I know how to make it, coming very close to my default LAN interface settings as far as rules go. They ought to be identical. The two smart switches are set up such that port 5 is “in” and 1 is “out”. Living room 5 connects to the firewall. Living room 1 connects to the office switch’s port 5. Office switch 1 connects to the end point mini PC. Living room ports 1-5 are untagged for VLAN 1; ports 1 and 5 are tagged for VLAN 10. Office ports 2-5 are untagged for VLAN 1; for VLAN 10, 1 is untagged and 5 is tagged, and port 1 has a PVID of 10.
I spelled all of that out in hopes that I did something stupid that I don’t know how to spot but maybe you do. Every device on VLAN 1 is working as it should with internet access. The one device on VLAN 10 only has access to the gateway and nothing else, despite the most permissive “allow everything” rule I could set up.